We’ve put together several CloudFormation templates for defining IAM groups at various levels of access. For more information, see https://github.com/stelligent/aws_group_policy